Copy-on-write memory: private views and physical storage

Two address spaces can initially refer to the same physical bytes while preserving the rule that a later private write must not change the other's logical view. The sharing is safe only because the system intercepts a write before allowing that change to affect the common page.

copy-on-write memory postpones duplication until a covered write needs private storage. Its savings depend on the pages actually changed, while its later cost includes allocation, copying and the writer's mapping transition.

The examples stipulate four-KiB pages and two address spaces. They count physical payload storage separately from logical mappings and do not claim a measured saving for a particular operating system.

Draw shared page ownership through two mappings

Let address spaces P and Q each map a virtual page to physical frame F. Both see the same initial contents through their own virtual addresses. In this model, both mappings permit reads but intercept writes.

The logical contract lets each address space eventually make its own private modification. The initial hardware permission does not yet allow an ordinary write to F through either mapping. That distinction is intentional. The permission failure lets the system establish private storage before applying the modification, implementing the logically writable contract through interception.

Physical frame F is retained while the applicable mappings or other references still need it. Removing one mapping does not automatically release the frame if the other address space continues to use it.

The structured concurrency guide provides a lifetime comparison for shared page ownership. Actual child settlement is required before cleaning up resources those children still need. In this page model, replacing P's mapping likewise leaves a separate obligation to retain F for Q. Neither a changed mapping nor a requested cleanup proves that every old user has finished. The peer discusses task-resource lifetime; our private-write guarantee comes from the stated page transition.

Private identifies the write's intended logical effect. Before that write, the physical storage can remain shared even though the address spaces are distinct.

Trace write fault copying before applying the modification

Suppose P tries to change one byte while Q still maps F. P's write encounters the stipulated write-interception condition. The system must resolve it under the copy-on-write contract before the modification becomes part of P's logical state.

In the model, it allocates a new physical frame G and copies F's complete four-KiB contents into G. The original bytes are needed so every unchanged location in P's page retains its earlier value.

It then establishes P's mapping to G with the intended private write permission. Q's mapping remains directed to F. The attempted modification can now affect G without changing the bytes Q reads from F.

Give F a checkable pair of bytes: offset 10 contains 7 and offset 11 contains 9. Copying F to G preserves both. P's attempted edit changes offset 10 in G to 8. After the transition, P reads 8 and 9 through G, while Q still reads 7 and 9 through F. This tests the edited byte and an unchanged neighbour. A later P edit to offset 11 can use its existing private G; the model requires no second copy of that page.

The final relationship is P-to-G and Q-to-F. The small logical edit changed P's bytes, while the mapping replacement preserved the independent view promised to Q.

The pipeline backpressure guide gives a storage-accounting comparison for write fault copying. It counts queued, executing and retained outputs separately because a queue's slot count covers only one boundary. Here the two mapped views and their unique physical frames also need distinct accounts. A mapping count can stay unchanged while private-copy allocation grows. The peer explains resource ledgers; it does not establish how a particular operating system handles a write fault.

The copied contents and mapping changes need a consistent transition under the system's protection model. The example does not assume that several threads can independently replace the same mapping without coordination or specify an operating-system implementation for doing so.

Logical size and physical storage are different accounts

Before P's write, the two logical pages can occupy one physical frame F. Each address space has a page in its mapped view, but summing those view sizes would count the same physical payload twice. After the private copy, two physical frames hold the related pages. P's logical mapped page count remains unchanged. The extra physical allocation appeared without an increase in its number of logical pages.

Reference counts or another valid lifetime mechanism must account for the old frame's remaining users. The writer's mapping replacement changes one relationship; it does not prove every reference to F disappeared.

If a frame is genuinely no longer shared under the relevant contract, a design may be able to permit its sole remaining user to write without making another copy. That decision requires actual exclusivity evidence. It cannot be inferred from one address space having left.

A report can expose three separate quantities under this model: logical mapped payload for each address space, unique physical payload across both, and additional private allocation created by P's writes. For the 1,024-page extension below, the initial logical payloads sum to eight MiB while the unique physical payload is four MiB. After one private copy, the logical sum remains eight MiB and the unique payload rises by four KiB. Those fields are consistent even though their values differ; combining them under one memory label would hide the sharing relationship.

The storage account therefore needs the mapping and reference assumptions. A logical size counter alone cannot identify which pages are shared, private or still retained elsewhere.

Compare sparse changes with touching every page

Extend the model to 1,024 shared four-KiB pages. Each address space maps four MiB of payload, while their initial shared physical payload storage is four MiB. Metadata is outside this particular numerical account.

Keep Q's pages unchanged and let only P modify one initially shared page. The additional private payload storage is four KiB. The combined physical payload becomes 4,100 KiB, compared with the initial 4,096 KiB.

If P modifies 64 distinct initially shared pages, the additional payload is 64 times four KiB, or 256 KiB. The combined payload total is 4,352 KiB, equivalent to four and one-quarter MiB.

If P modifies all 1,024 initially shared pages while Q retains the originals, it allocates another four MiB of private payload under the copying rule. The combined payload becomes eight MiB.

All three histories begin with the same shared storage. The later saving differed with the dirty-page set. Logical address-space independence did not establish a fixed amount of physical storage avoided.

These totals assume every counted page was initially shared, only P performs the stated writes, and the private copies remain live. Additional users or releases would change the account and must be modelled explicitly.

A small edit can copy a whole page

Under the four-KiB granularity, changing one byte on a still-shared page requires a four-KiB private copy in this model. The copied unit is the page, not only the edited byte. Two one-byte edits on that same page need not cause two page copies if P's first transition already established a private writable G. The second edit uses the existing private page under these assumptions.

Two one-byte edits on two different initially shared pages can instead require two copies, totalling eight KiB of additional payload. The number of bytes logically changed is the same as in the same-page case, while the allocation differs.

This is why the location of modifications matters. A scattered set of tiny writes can touch many pages, while a larger contiguous update can remain within fewer page units.

The example concerns copying granularity rather than translation-cache reach or allocator fragmentation. It does not derive a preferred page size for an actual workload.

Account for the postponed work and failures

Sharing avoids copying untouched pages at the initial separation point. When a covered write occurs, the system has later work to perform: obtain private storage, preserve unchanged contents and establish the correct mapping.

A design must account for allocation failure or another inability to complete that transition. The logical intention to make a private write does not supply a physical frame when the system cannot allocate one. The failure contract must also prevent a partial transition from exposing the writer's modification to Q or losing P's required original contents. The model needs an admissible outcome rather than silently treating an incomplete copy as success.

These obligations are separate from the numerical payload totals. Storage accounting and transition correctness need separate checks; either can be established without a measured cost for the workload.

The timing of the cost changes as well. Work deferred until the first write can affect that operation's execution rather than the initial creation of the second view. This article makes no performance benchmark claim about that timing.

Verify views and storage through the mapping transition

Record the initial P-to-F and Q-to-F mappings, their permissions and the sharing assumptions. For P's first write, inspect the allocated G, preserved contents and final mapping relationships under the stipulated transition.

The useful content check compares P's edited byte and unchanged locations with Q's original page. A success flag for a fault handler would not establish those two independent logical views.

For the storage calculation, count unique live physical payload pages rather than adding every logical mapping. Keep the initial sharing and dirty-page set so the incremental allocation can be reproduced.

A same-page second edit and a different-page edit test the granularity boundary. The calculation should add a copy only when the stated sharing and permission conditions require one.

A frame ledger can be saved beside the virtual-mapping diagram on the Lenovo IdeaPad 15.6-inch FHD touch laptop. The listed 16GB DDR4 memory accompanies an i5-1334U processor and a 512GB PCIe SSD. Record P-to-F and Q-to-F before the edit, then P-to-G and Q-to-F afterward. Count each unique live frame once while retaining a separate row for each address space's logical payload.

For inspecting the byte checks alongside that ledger, the ASUS Vivobook 14 FHD laptop is listed with a Core 5 120U processor and 16GB DDR4 memory. Keep the original bytes 7 and 9 beside P's resulting 8 and 9 and Q's unchanged 7 and 9. Those values verify the two views in the declared model. The installed-memory specification supplies no evidence about a real application's dirty-page set.